Red Hat Bugzilla – Bug 446402
CVE-2008-2302 Django: administration application XSS
Last modified: 2016-03-04 07:36:00 EST
Following advisory was published by Django security team:
The Django administration application will, when accessed by a user who is not
sufficiently authenticated, display a login form and ask the user to provide the
necessary credentials before displaying the requested page. This form will be
submitted to the URL the user attempted to access, by supplying the current
request path as the value of the form's "action" attribute.
The value of the request path was not being escaped, creating an opportunity for
a cross-site scripting (XSS) attack by leading a user to a URL which contained
trunk, 0.96, 0.95, 0.91
(see upstream advisory for 0.95 and 0.91 patches)
Fixed upstream versions:
0.96.2, 0.95.3, 0.91.2
Affected versions shipped in F7, F8, F9, rawhide and EPEL5.
Django-0.96.2-1.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
Django-0.96.2-1.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
Django-0.96.2-1.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
This issue was addressed in: